Privacy notice

How we handle personal data on this website, under Articles 13 and 14 GDPR and the UK GDPR.

Last updated: 2 September 2026

Two items before publishing. First, confirm the European Commission's adequacy decision for the United Kingdom is in force on the day this goes live — it has been extended on a rolling basis; if it has lapsed, the transfer section needs Standard Contractual Clauses or the UK IDTA instead. Second, the agent below is now a live model call, so the “Your conversation with the agent” section describes real processing — but two of its values still need confirming against the signed contract: Anthropic's trust-and-safety retention period, and the transfer mechanism named further down. Note also that the deployment can run with the model turned off (agent_enabled), in which case a scripted fallback answers and nothing leaves the browser at all. Remove this block before publishing.

Who is responsible

Controller: Nemtio Limited, 71–75 Shelton Street, London WC2H 9JQ, United Kingdom
Company number: 16889481 — Companies House, England and Wales
Director: Patrick Hohenecker
Contact: Use Get in touch on the main page

We have not appointed a data protection officer; we are not required to. Questions about this notice reach the director directly.

What we process, and why

Your conversation with the agent

The questions you type are sent to an AI provider so an answer can be generated, and are processed to answer you and to improve which questions the agent handles well.

Data: the text you type, the language you selected, and a technical session identifier.
Lawful basis: Art. 6(1)(b) GDPR where you are asking about a possible contract, and Art. 6(1)(f) — our legitimate interest in running and improving an information service.
AI provider: Anthropic PBC, San Francisco, California, United States (Claude API) — our processor under Art. 28 GDPR, on the basis of Anthropic's Data Processing Addendum.
Training: your input is not used to train Anthropic's models. This is excluded by their commercial terms.
Retention: we do not store your conversation at all. It is held in your browser for the length of your visit and sent to the AI provider to generate each answer; nothing is written to a database or a log on our side. Anthropic retains inputs separately for up to 30 days for trust-and-safety purposes [confirm against the signed contract].

The contact form

Data: your email address, and optionally your organisation type and weekday trip volume.
Purpose: to reply to you and arrange a planning pass or a call.
Lawful basis: Art. 6(1)(b) GDPR — steps prior to a contract at your request.
Retention: 24 months after our last contact, unless a business relationship begins.

Server logs

Data: IP address, timestamp, requested page, browser and operating system.
Purpose: delivering the site, security, and diagnosing faults.
Lawful basis: Art. 6(1)(f) GDPR.
Retention: 30 days — the default retention of our hosting provider's logging service.

Storage on your device

This site stores only what it needs to work, so there is no cookie banner — there is nothing optional to consent to.

Session identifier — keeps your conversation together while you use the site. Expires when your session ends.
Language and theme — stored in your browser's local storage only after you actively choose one, so your choice survives a reload. Nothing is written before you choose.

There is no analytics, no advertising, no tracking, and no profiling.

Everything this site needs — its fonts, its interface icons and the code it runs on — is served from our own servers. No third party is contacted when you load a page, and no content delivery network receives your IP address.

Who else receives data

Hosting: Google Cloud EMEA Limited (Google Cloud Platform), region europe-west1 in Belgium — as our processor, under Google's Cloud Data Processing Addendum.
AI provider: Anthropic PBC, San Francisco, United States — as our processor, as described above.

We do not sell personal data and do not share it for any other purpose.

Where data is stored, and transfers

Your data is stored in the European Union — Google Cloud region europe-west1 in Belgium. Google's own support and sub-processing functions may access data from outside the EEA; those transfers are covered by the Standard Contractual Clauses in Google's Cloud Data Processing Addendum.

Nemtio Limited is established in the United Kingdom, so our staff accessing that data constitutes a transfer from the EEA to the UK. This relies on the European Commission's adequacy decision for the United Kingdom [confirm in force at publication].

Anthropic PBC processes conversation text in the United States. That transfer relies on the Standard Contractual Clauses in Anthropic's Data Processing Addendum. A copy of the safeguards is available on request.

Your rights

You have the right to access your data (Art. 15), correct it (Art. 16), have it erased (Art. 17), restrict processing (Art. 18), receive it in portable form (Art. 20), and object to processing based on legitimate interest (Art. 21). Where you gave consent, you may withdraw it at any time.

You may also complain to a supervisory authority — in the UK the Information Commissioner's Office, or in the EU the authority in your country of residence.

Please do not enter patient or other personal health data into the conversation. It is not needed to answer any question about Nemtio, and it would be transmitted to our AI provider.

Changes

We will update this notice when the site or its processing changes, and the date above will change with it.

← Back to Nemtio

Deutsche Fassung: Datenschutzerklärung